This section is intended to introduce the reader to various aspects of art, which may be related to various aspects of the present disclosure that are described and/or claimed below. This discussion is believed to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present disclosure. Accordingly, it should be understood that these statements are to be read in this light, and not as admissions of prior art.
In wireless communications, it is often desirable to restrict access to a so-called access point to authorized client devices only. Wi-Fi, the most widespread wireless networking technology, will be used herein as a non-limitative illustrative example.
A first solution for authenticating client devices is through the use of certificates, but as these require complex installation and management, the solution is not suitable in many cases.
A second solution uses a shared secret that a user inputs on a client device, which then proves knowledge of the shared secret to the access point.
The second solution is widely used in for example Wi-Fi Protected Access (WPA) Personal (also known as WPA-PSK (Pre-Shared Key)), having a second version called WPA2 Personal, described in the standard IEEE 802.11i and illustrated in FIG. 1.
In steps S102 and S104, the client device STA and the access point AP independently of each other derive a Pairwise Master Key (PMK) using a key derivation function called Password-Based Key Derivation Function 2 (PBKDF2) taking as input a shared passphrase, a network identifier called Service Set Identifier (SSID) and the length of the SSID. Alternatively, the PMK can be entered as a string of 64 hexadecimal digits.
In step S106, the AP generates a random number (i.e., a nonce) ANonce that it sends in a message 108 to the STA.
STA generates a random number (i.e., a nonce) SNonce, in step S110, and generates, in step S112, a Pairwise Transient Key (PTK) from the nonces, the PMK and the Media Access Control (MAC) addresses of the client device STA and the access point AP. STA then generates, in step S114, a Message Integrity Code (MIC) for SNonce; the MIC is the keyed cryptographic hash (HMAC-SHA1 or AES-CMAC) of the SNonce. The MIC uses the 128-bit PTK as key. STA then sends SNonce and the MIC in message 116 to AP.
Upon reception of SNonce and the MIC, the AP derives, in step S118, the PTK in the same way as STA did in step S112. In step S120, the AP verifies that the MIC is correct. At this point, STA and AP are authenticated and have mutually derived the same PTK.
The AP sends to STA message 122 comprising a Group Temporal Key (GTK) and a sequence number protected using a second MIC (encrypted using bits 128-256 of PTK). Upon reception of message 122, STA installs, in step S124, the GTK, which then can be used to send packets to the wireless network managed by the AP. Finally, STA sends an acknowledgement 126 to the AP.
Another possibility is WPA-Enterprise that works in a different way in order to offer Extensible Authentication Protocol (EAP). Among the many EAP protocols, the most common are Protected Extensible Authentication Protocol (PEAP), Transport Layer Security (TLS) and Tunnelled Transport Layer Security (TTLS). Among these, TLS requires certificates on both the client and the server, while TTLS and PEAP are quite similar in that they both have a certificate on the server and a password input by the client.
As an example, PEAP uses Microsoft's Challenge Handshake Authentication Protocol, version 2 (MS-CHAP v2) to exchange the password as follows. The client and an authenticator (RADIUS server) establish a tunnel through the AP. The authenticator sends a Session ID and a first challenge to the client, which replies with a user name, a second challenge and a hash of the challenges, the Session ID and the MD4 hash of the user's password. The RADIUS server checks the hash and responds with success or failure as appropriate, and informs the AP to accept the client, which causes the AP to initiate a 4-way handshake with the client to adopt a shared key.
A problem with shared secrets and passwords is that inputting them is a task that is prone to error, in particular when the data to input is long or complicated, as is often the case for Wi-Fi in order to provide an acceptable level of security. In an attempt to mitigate this problem, it has been proposed to use Wi-Fi Protected Setup (WPS). However, many devices, such as iOS devices, do not support WPS and some implementations of WPS have been plagued by security issues, thus limiting their use.
In “pASSWORD tYPOS and How to Correct Them Securely,” Chatterjee et al.
propose authentication methods that are tolerant to typos in passwords. While the paper provides some formal evaluation, but proposes only theoretical solutions without providing any implementations or how to integrate such an approach in an authentication protocol that already exists.
Other typo-tolerant solutions have been described in for example EP 2947591, EP 2876569, EP 3067811, US 2015/0363588 and US 2015/0363593 that all necessitate modification of the client device, and U.S. Pat. No. 9,280,657 in which the server learns to accept input, faulty passwords followed by a correct password. As such, these conventional solutions have drawbacks.
Another problem with shared secrets and passwords in networks based on technologies like Wi-Fi is that they use a single shared secret or password. To give, for example, a guest access to the network, this is either done by giving the guest the network password. This means that the guest can continue accessing the network until the network password is changed, which is inconvenient since changing the network password requires changing the password on every device that should have access to the network.
On the other hand, a gateway may use a second SSID to provide a guest with for example Internet access, but since the second SSID is different from the first SSID, this does not enable access to the network of the first SSID.
A different solution is the use of one-time passwords, but these typically do not give a guest access to the same network as that used by the users.
It will be appreciated that it is desired to have a solution that overcomes at least part of the conventional problems related to input of shared secrets in wireless communication networks.